CVE-2020-35653

Vulnerability

CVE-2020-35653 is a buffer over-read vulnerability in Pillow's PCX decoder, PcxDecode. The root cause is that the decoder trusts a user-supplied stride value from the crafted PCX file when calculating buffer boundaries, without proper validation. This allows the decoder to read beyond the allocated buffer, resulting in a buffer over-read. The flaw is present in Pillow versions prior to 8.1.0 [1][2].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted PCX image file with a malicious stride value. Exploitation does not require authentication, as the attack vector is through file processing. A victim must open or process the crafted PCX file using an affected Pillow version. The attack complexity is low, as no special conditions beyond providing the file are needed [1][2].

Impact

Successful exploitation leads to a buffer over-read, which can cause information disclosure through reading out-of-bounds memory. In some scenarios, this could also lead to a denial of service (e.g., application crash) if the read access violates memory protections. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, indicating high confidentiality and availability impact with no privileges required [1][2].

Mitigation

The vulnerability is patched in Pillow version 8.1.0. Users are strongly advised to upgrade to this or a later version. For systems where upgrading is not immediately possible, avoiding processing untrusted PCX files can serve as a temporary workaround. Debian has also released a security update for its LTS distribution [2][3].